untangling_the_web

DID: 4046925
UNCLASSIFIEDlIFOR OFFICIAL blS~ QNb¥
something I encourage or advocate. I do encourage you to "hack" your own website
to see what kinds of information is being revealed inadvertently via Google and other
search engines.
Also, a lot of the best information Johnny offers is for his site members only, and I do
not want to suggest you register there. Nonetheless, Johnny's briefing slides from
the 2004 Black Hat and Defcon12 conferences are available at the official Black Hat
Briefings website and elsewhere (so much for registration). I have also found his
excellent white paper "The Google Hacker's Guide" at other sites that do not require
registration; there is another very good briefing on the dangers of Google by
Sebastian Wolfgarten.
There was a fair amount of sniping following Long's talks at Black Hat and Defcon,
mostly of the "big deal" variety, i.e., it is not "real" hacking and therefore not worthy
of presenting at Defcon. However, this is a very shortsighted point of view when one
considers the kinds of information that is so very easily available via Google, et al.
How would you like to see your Social Security Number, credit card number, and
that very handy little three digit number on the back of your credit card used for
"verification," bank routing information, mother's maiden name, etc., in the next
Google hacking briefing? Yes, all this kind of information is readily available (I
know...I've uncovered quite a bit of it myself). And this doesn't even take into
consideration all the other website weaknesses, such as multiple vulnerabilities with
liS 6.0 Web-based administration, that can be exposed using Google.
Johnny Long's Googledorks Page
http://johnny.ihackstuff.com/ghdb.php
Johnny Long's "The Google Hacker's Guide"
http://www.securitymanagement.com/library/Google Hacker0704.pdf
Johnny Long, "You Got That With Google?" Black Hat Briefings and Defcon12, July
2004.
http://www.blackhat.com/html/bh-media-archives/bh-archives-2004.html#USA-2004
Johnny Long, "Google Hacking Mini-Guide," Informit.com, 7 May 2004
http://www.informit.com/articles/printerfriendly.asp?p=170880
Sebastian Wolfgarten, "Watch Out Google"
http://www.wolfgarten.com/downloads/Watch out google.pdf
Joe Barr, "Google Hacks are for Real," Newsforge.com, 6 August 2004
http://www.newsforge.com/article.pl?sid=04108105/1236234
Taken all together, the information Johnny Long has found using Google (he sticks
with this one search engine), combined with the techniques he details at his website,
provide an excellent tutorial on using Google to find stuff that really should not be on
the public Internet or easily accessible via a search query. Furthermore, the greatest
value of his efforts may not be in finding useful information but in demonstrating the
vulnerabilities of any given website and the necessity of taking strong measures to
UNCLASSIFIEDIJrQR OFFl61J1cL USE ONLY 179